Enumerate gRPC services via reflection and test unauthenticated access.
npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-grpc
Please help me install this Agent Skill. Skill: hunt-grpc Source: https://github.com/sseshachala/Claude-BugHunter-archive/tree/main/skills/hunt-grpc Command: npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-grpc
Enumerate and exploit gRPC service exposure to identify misconfigurations, weak auth, and data leakage in microservices.
Enumerate gRPC services via reflection and begin unauthenticated testing with grpcurl against the target.
High-intent search queries and answers about installing and using this skill.
You can enumerate gRPC services without proto files by using server reflection to build a full API catalog. This allows you to discover available endpoints and methods directly from the target service.
The best way to test for unauthenticated access on gRPC endpoints is by enumerating services via reflection and then using grpcurl to call methods directly. This identifies missing authentication and internal endpoint exposure.
gRPC-Web proxy exposure leads to proto leakage when misconfigured proxies expose internal service definitions. Testing these scenarios reveals plaintext gRPC communications and disclosed proto file structures.
Yes, you can use this to find gRPC misconfigurations on microservice architectures. It targets environments exposing gRPC over TLS on ports like 443 or 50051 to detect weak auth and data leakage.
To check a gRPC target for HTTP/2 rapid reset DoS considerations, you test the service's exposure and configuration limits. This structured workflow identifies potential denial of service vectors during endpoint analysis.
gRPC reflection exposes internal endpoints because it is designed to return service definitions to clients for dynamic method invocation. When left enabled without authentication, attackers can map the entire API surface.
uphiagoDetect gRPC vulnerabilities including unauthenticated RPC access and metadata spoofing.
333-333-333Define protobuf contracts and generate Go gRPC stubs for microservices.
SkobynIdentify gRPC security vulnerabilities via reflection enumeration and authentication bypass testing.
NammDevDevelop production-ready backends with Node.js, Python, or Go and REST, GraphQL, or gRPC APIs.
